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REMARKS/ARGUMENTS 

Claims 1-19 and 25-43 are pending in the application. Claims 25-43 are 
rejected as containing subject matter which is not described in the specification under 
35 U.S.C. 1 12, first paragraph; and claims 1-19 and 25-43 are also rejected as 
anticipated under 35 U.S.C. 102(e). The rejection is traversed and reconsideration is 
requested. The rejection of claims 25-43 under 35 U.S.C. 1 12 is based solely on 
grounds withdrawn by the Examiner. Further, the reference asserted does not teach or 
suggest the claimed invention. 

Claim Amendments 

The foregoing amendment of claims 1 and 25 specifies, for example, that the 
first web server provides a first type of service session functionality for the user in 
addition to and different from authenticating the user, creating an encrypted 
authentication token, or redirecting a web browser of the user to transmit the 
encrypted authentication token, which first type of service session functionality is also 
different from a second type of service session functionality provided for the user by a 
second web server that is not provided by the first web server, which second type of 
service session functionality is also in addition to and different from authenticating 
the user, creating an encrypted authentication token, or redirecting a web browser of 
the user to transmit the encrypted authentication token, each of said web servers 
containing information identifying the type of service session functionality provided 
by the other of said web servers and an address for the other of said web servers . See , 
e.g., Specification, page 1, lines 20-25; p. 4, line 25-page 6, line 5; page 7, lines 4-19; 
page 12, lines 21-24; and Figs. 1-3. 

Support for the foregoing amendment is found throughout the specification 
and in the claims. Accordingly, no new matter has been added. 

Claim Rejections - 35 U.S.C § 112 

In the Office Action mailed July 15, 2005, the Examiner rejected independent 
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claims 1 and 25 under 35 U.S.C. 1 12, first paragraph, because the Examiner 
considered that the specification does not disclose ". . .providing a first type of service 
session. . and a "second type of service session" as identically recited in each of 
independent claims 1 and 19. The Examiner also rejected claims 2-19 depending on 
claim 1 and claims 26-43 depending on claims 25 by virtue of their dependency. 

In the Response filed on October 17, 2005, while the rejection of claims 1-19 
and 25-43 under 35 U.S.C. 1 12, first paragraph, was noted and traversed and 
reconsideration of the rejection was requested at page 8 of the Response, a reference 
to independent claim 25 and claims 26-43 depending on claim 25 was inadvertently 
omitted from the detailed discussion overcoming the rejection at pages 9-11 of the 
Response so, as pointed out by the Examiner in the Final Office Action mailed 
January 30, 2006 , the detailed discussion referred only to independent claim 1 and 
claims 2-19 depending on claim 1. 

While the Examiner acknowledged in the Final Office Action mailed 
January 30, 2006 that the arguments presented in the detailed discussion overcoming 
the rejection at pages 9-1 1 of the Response were persuasive and withdrew the 
rejection of independent claim 1 and claims 2-19 depending on claim 1, the Examiner 
maintained the identical rejection of independent claim 25 and claims 26-43 
depending on claim 25 for the sole reason of the inadvertent omission of reference to 
those claims in the detailed discussion overcoming the rejection at pages 9-1 1 of the 
Response. 

Out of an abundance of caution, the detailed discussion overcoming the 
Examiner's prior rejection under 35 U.S.C. 1 12, first paragraph, is re-presented below 
with respect to the Examiner's rejection of 25-43 in the Final Office Action mailed 
January 30, 2006 and is identical to the detailed discussion overcoming the identical 
rejection of claims claim 1-19 presented at pages 9-1 1 of the Response filed 
October 17, 2005, except substituting claims 25-43 for claims 1-19: 
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Claims 25-43 stand rejected under 35 U.S.C. 1 12, first paragraph, 
because the Examiner considers that "the specification does not disclose, 'a 
first type of service session...', and a 'second type of service session'" and the 
Examiner further considers '"a first type of service session..."' and 'a second 
type of service session' as authenticating a user to create an encrypted 
authentication token and redirecting a web browser of the user to transmit the 
encrypted authentication token". 

Turning first to the Examiner's statement that "the specification does 
not disclose, 'a first type of service session...', and a 'second type of service 
session'", as explained in the "Background" section of the application: 

Such an entity or group of entities may wish to allow their customers 
access to such an aggregated functionality by signing on only once, by 
authenticating themselves once, and then being able to use different 
services which might be provided either by different servers of entities 
within the group of entities, or by servers of the group of entities and, 
for example, by servers of third party entities . Application, p. 1 , lines 
20-25. 

As further explained in the example embodiment described with reference to 
Figs. 1-3: 

Once the customer logs into the brokerage firm web site 32, the web 
site 32 presents the customer 10 with a welcome page from the web site 
32. Once logged in, the customer 10 may examine the customer's 
brokerage account information, portfolio, investment information, and 
the like. Application, p. 5, lines 14-17. 

Referring again to FIG. 2, the customer 10 requests bill payment 50 by 
clicking on the "bill payment" hyperlink 102. The brokerage firm web 
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server 30 itself does not handle the process of bill payment, but the 
server 30 is programmed with the knowledge that the bank web server 
40 handles such a process . The hyperlink 102 includes the URL of the 
bank web site 42. Upon detecting the request of bill payment, the 
brokerage firm server 30 builds an authentication token 52. An 
authentication token comprises an object (or data) that can be passed 
between cooperating servers. A function of an embodiment of an 
authentication token is to convey the necessary information from a 
primary (or first) server to a secondary (or second) server to allow the 
secondary server to skip the sign-on process that would otherwise be 
necessary and required. Once a primary server establishes a session for 
a user, a cooperating secondary server that receives a valid 
authentication token from the primary server can establish a session 
without having the user sign on again. Application, p. 5, lines 24-p. 6, 
line 5. 

The customer client 10 receives the web page 100 and proceeds with 
the bill-payment session with the bank server 40. In an embodiment, 
the authentication token (cookie) is then discarded or destroyed by the 
web server 40. Application, p. 12, lines 21-24. 

Thus, the Examiner's statement that the specification does not disclose 
first and second types of service session functionality, as recited in claim 1, is 
likewise simply wrong, in that the foregoing passages clearly describe an 
example embodiment in which a first type of session service functionality 
comprises a brokerage type of session service functionality at the brokerage 
firm web site 32 where the customer 10 may, for example, examine the 
customer's brokerage account information, portfolio, investment information, 
and the like, and a second type of session service functionality that comprises 
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a banking type of session service functionality at the bank web site 40 in 
which the customer can conduct a bill-payment session. 

Regarding the Examiner's claim that "a first type of service session" and "a 
second type of service session", as recited in claims 1 and 25, must both be construed 
as "authenticating a user to create an encrypted authentication token and redirecting a 
web browser of the user to transmit the encrypted authentication token", the claim is 
patently wrong and completely disregards and is completely contrary to the plain 
language of the limitations of claim 1 and 25. Nevertheless, the foregoing 
amendment of claims 1 and 25 further specifies: 

• that the first web server provides a first type of service session functionality 
for the user in addition to and different from authenticating the user, creating 
an encrypted authentication token, or redirecting a web browser of the user to 
transmit the encrypted authentication token and that the first type of service 
session functionality is also different from a second type of service session 
functionality provided for the user by a second web server ; 

• that the second type of service session functionality provided by the first web 
server is not provided by the first web server and that the second type of 
service session functionality is also in addition to and different from 
authenticating the user, creating an encrypted authentication token, or 
redirecting a web browser of the user to transmit the encrypted authentication 
token . 

In view of the Examiner's withdrawal of the rejection of independent claim 1 
and claims 2-19 depending on claim 1, and in view of the foregoing amendment, the 
identical rejection of independent claim 25 and claims 26-43 depending on claim 25 
should likewise be withdrawn and the same is hereby requested. 
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Claim Rejections - 35 US.C. §102 

Claims 1-19 and 25-43 stand rejected as anticipated by Sasmazel (U.S. Patent 
No. 6,263,432) under 35 U.S.C. § 102(e). The rejection is traversed and 
reconsideration is requested. 

The rejection of independent claims 1 and 25 is based primarily on the 
Examiner's patently incorrect premise that the first and second types of service 
session functionality provided at the first and second web servers, respectively, 
consist of authenticating the user, creating the authentication token, and redirecting 
the user's web browser to the second web server. While it is readily apparent that the 
limitations recited in claim 1 preclude such a premise, the foregoing amendment of 
claims 1 and 25 specifically reciting first and second types of service session 
functionality for the user in addition to and different from authenticating the user, 
creating an encrypted authentication token, or redirecting a web browser of the user to 
transmit the encrypted authentication token , eliminates any basis for such premise. 

Sasmazel fails to teach or suggest one or more limitations recited in each of 
independent claims 1 and 25 in at least the following respects: 

• Instead of authenticating the user by a first web server that also provides a first 
type of service session functionality for the user in addition to and different 
from authenticating the user, creating an encrypted authentication token, or 
redirecting a web browser of the user to transmit the encrypted authentication 
token , as recited in amended claims 1 and 25, according to Sasmazel, the web 
server is incapable of authenticating the user but instead sends the user's sign- 
on request to a dedicated authentication server that provides no type of service 
session functionality other than authenticating the user. See, e.g., Sasmazel, 
Col 7, line 38-Col 10, line 30 and Figs. 6 and 7. 

• Instead of detecting a client request for a second type of service session 
functionality at the first web server that is not provided by the first web server 
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and that is also other than authenticating the user, creating an encrypted 
authentication token, and redirecting a web browser of the user to transmit the 
encrypted authentication token , determining by the first web server a second 
web server which provides the second type of session functionality, and in 
response thereto creating an encrypted digitally signed authentication token 
related to the user, redirecting the user's browser to the second web server by 
the first web server, and transmitting the token from the first web server to the 
second web server, as recited in amended claims 1 and 25, according to 
Sasmazel, upon receiving the user's sign-on request from the web server, the 
dedicated authentication server simply creates and sends an "eticket" back to 
the user's browser, where it remains until the user signs on again at the same 
or another web server to request another function, at which time, the user's 
browser sends the "eticket" to the particular web server, which forwards the 
"eticket" on to a dedicated authorization server. See , e.g., Sasmazel, Col 10, 
lines 9-24 and Fig. 7. 
• Instead of authenticating the authentication token and providing the second 
type of service session functionality for the user (i.e., other than authenticating 
the user, creating an encrypted authentication token, and redirecting a web 
browser of the user to transmit the encrypted authentication token ) by the 
second web server, as recited in amended claims 1 and 25, according to 
Sasmazel, when the user signs on again at the same or another web server to 
request another function and the user's browser sends the "eticket" to the 
particular web server, the web server forwards the "eticket" to the dedicated 
authorization server to authenticate the user. See, e.g., Sasmazel, Col 10, lines 
20-30 and Fig. 7. 

Consequently, Sasmazel fails to teach the required combinations of limitations 
of Applicants' method and system of single sign-on user access to multiple web 
servers as recited in amended independent claims 1 and 25. Because each and every 
element as set forth in independent claims 1 and 25 is not found, either expressly or 
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inherently in the cited reference, the Examiner has failed to establish the required 
prima facie case of unpatentability. See Verdegaal Bros, v. Union Oil Co. of 
California , 814 F.2d 628 (Fed. Cir. 1987); See also MPEP §2131. The Examiner has 
failed to establish the required prima facie case of unpatentability for independent 
claims 1 and 25 and similarly has failed to establish a prima facie case of 
unpatentability for claims 2-19 that depend on claim 1 and claims 26-43 that depend 
on claim 25, and which recite further specific elements that have no reasonable 
correspondence with the references. 
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Conclusion 



In view of the foregoing amendment and these remarks, each of the claims 
remaining in the application is in condition for immediate allowance. Accordingly, 
the examiner is requested to reconsider and withdraw the rejection and to pass the 
application to issue. The examiner is respectfully invited to telephone the 
undersigned at (336) 607-73 18 to discuss any questions relating to the application. 



Respectfully submitted, 





JohrfM. Harrington (Reg. No. 25,592) 
for George T. Marcou (Reg. No. 33,014) 



Kilpatrick Stockton LLP 
607 14th Street, NW, Suite 900 
Washington, DC 20005 
(202) 508-5800 
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